This page describes the security.properties file used in PaperCut NG/MF to manage secure aspects of print/device scripting, custom user sync, and card conversion scripts
It’s important to strike the right balance between offering rich features and ensuring optimal security. PaperCut NG/MF uses a permission-controlled security.properties file to manage the security aspects of the following advanced features:
- Print Scripting
- Device Scripting
- Custom Program for User Sync and Authentication
- Card Conversion and Card Number Conversion
- External database Card Number Lookup
By offering control of these settings, you can harness these powerful features when necessary while also minimizing the attack surface area for features that might not be in use.
The default settings are selected to have the right balance of security for the majority of customers.
Where to enable and configure the advanced features security
Configure and/or enable the advanced features in the security.properties file. This file:
- is located in
[app-server]/serverfor all operating systems - for security reasons, can only be edited by operating system administrators
- requires a PaperCut Application Server restart.
security.properties file configuration summary
The security.properties configuration file contains comments and descriptions for each security key setting. Most administrators will quickly understand and edit the file. Here’s a summary, including links to the related documentation.
- Configure the
security.propertiesfile for the features you want to use, according to these procedures: - If you are using Site Servers, edit the
security.propertiesfile for each of the Site Servers to reflect the changes that you made in thesecurity.propertiesfile on the Application Server. - If you haven’t already, restart the PaperCut Application Server.
- Follow the procedure for the feature(s) you are implementing:
Security keys and their default values
Security key | Description |
|---|---|
| Controls whether print scripts and device scripts are enabled. ------------- Applicable to both PaperCut NG and MF. Default = |
| Controls whether print scripts are allowed to execute potentially unsafe code, such as calling other programs. Enabling this allows powerful raw Java functionality but comes at a potential security risk. ----------------------- Applicable to both PaperCut NG and MF. Default = |
| Controls if device scripts are allowed to execute potentially unsafe code, such as calling other programs. Enabling this allows powerful raw Java functionality but comes at a potential security risk. ----------------------- Applicable to PaperCut MF only. Default = |
| Controls which directories that custom executable files are allowed to be executed within. You can grant access to multiple directories by separating them with a semicolon (;). This may be useful for testing new versions. If an executable is found in more than one of the directories, the first directory matched will be used based on the order it is entered in the key. Best practice is to store the executable files on the local filesystem in a secure location. Use absolute paths, and do not include the executable name as part of the path. Example: Example: The executable name set in the admin interface must exist in one of the paths listed in the allowed directory list key. Note: The custom source program does not need to be in the PaperCut install directory. Example directories: Linux
Windows*
For more details, see Synchronizing and authenticating user and group details with custom programs. ------------------------------------ Applicable to both PaperCut NG and MF. Default = empty |
| Controls whether card conversion scripts are allowed to execute potentially unsafe code, such as calling other programs. Enabling this allows powerful raw Java functionality, but comes at a potential security risk. ------------------------------- Applicable to both PaperCut NG and MF. Default = |
| Controls what directories card conversion scripts are allowed to be executed within. Separate multiple values with a semicolon (;). Best practice is to store the executable files on the local filesystem in a secure location. Use absolute paths, and do not include the executable name as part of the path. Example: Example: The executable name set in the admin UI must exist in one of the paths listed in the path-allow-list. Do not enter the executable name in the path(s) listed in the key value. Note: The custom source program does not need to be in the PaperCut install directory. Example paths: Linux
Windows*
Example: ---------------------------- Applicable to PaperCut NG and MF. Default = empty |
| Introduced in version 25.0.11, this key defines a restricted list of filesystem paths authorized for Shared Account synchronization. When configured, the application validates all import requests against this allow-list; any attempt to sync from a file or directory outside these paths is blocked to prevent unauthorized filesystem access. How Security Enforcement WorksThe way this feature behaves depends on when you installed PaperCut.
Update the Security Properties File
Note: If you try to sync a file outside of these paths, you will see a "Directory is not in the allowed sync list" error. Example paths: Windows
Linux and macOS
|
| Introduced in version 26.0.5, 25.0.13 and 24.1.10, these keys define the configuration for external database card/ID number lookups.
See Configuring an external database for card/ID numbers for more information. |
Comments
Comments are not available in this preview environment. On papercut.com, this space shows the live Disqus comment thread for this page.